Researchers from UMass Amherst have discovered a serious flaw in Visa's EMV payment system that allows expired contactless cards to make real purchases. By exploiting an unsigned expiry field in the card's EMV kernel, the team demonstrated that these expired cards could be used for transactions at actual retail and grocery stores. This raises significant concerns for consumers and merchants alike, as it means that cards which should no longer be valid can still facilitate payments. The potential for fraud is alarming, especially since many users may not be aware that their expired cards could still be functional. This incident highlights the urgent need for Visa and other financial institutions to address security vulnerabilities in their payment systems to protect users from unauthorized transactions.